This might be a result of a custom author plugin not escaping these characters on the way into the database, but Wordpress should handle this more robustly to prevent plugin authors from messing things up like this.